An improper state validation flaw in Chrome’s DevTools allowed a remote attacker to execute arbitrary code within the sandbox by loading a specially crafted HTML page. The vulnerability can be leveraged to run code with the privileges of the sandboxed context, potentially compromising sensitive data or enabling further tampering of the browser state. It is a high‑severity RCE scenario as reflected by the CVSS score.

All users of Google Chrome running a version older than 155.0.8059.39 are impacted. The issue manifests when DevTools is invoked on an untrusted page that includes maliciously constructed content. The flaw is present across desktop operating systems that ship the affected Chrome build.

The CVSS score of 8.8 classifies this as a high‑risk vulnerability. EPSS data is not available, so the exact exploit probability is unknown, but the absence of public detection or listing in CISA KEV suggests that exploitation is at a low to moderate level at present. Nevertheless, a remote attacker could deliver a crafted HTML payload to a victim’s browser and trigger the flaw, resulting in code execution. Until the patch is applied, the risk remains high.